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ent's location, regardless of whether the message has been 
opened. For instance, a self- re moving message is designated 
as such by the message's originator, and a self-removal 
enhancement is added to conventional message content 
before the message is transmitted over a computer network 
toward one or more recipients. Al the recipient's location, 
the message is automatically deleted without additional 
effort by the recipient, before or after being displayed, 
according to the originator's instructions unless they are 
overridden by the recipient. ISPs and other message dis- 
tributors may identify messages that should be self- 
removing, and make them self-removing if they are not. 
Thus, the burden of removing unsolicited email messages is 
transferred from recipients to the system and the message's 
originators and/or to ISPs and other email distributors. 
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RELATED APPLICATIONS 

This application is a division of U.S. patent application 
Ser. No. 09/618,249 filed Jul. 18, 2000. 

This application is a continuation-in-part of commonly 
owned copending application Ser. No. 09/399,066 filed Sep. 
18, 1999, through which this application also claims priority 
to application Sen No. 60/101,517 filed Sep. 23, 1998 and to 
application Ser. No. 60/104,138 filed Oct. 14, 1998. 

FIELD OF THE INVENTION 

The present invention relates to the technical goal of 
facilitating the use of email (electronic mail) and similar 
broadcast or targeted transmission mechanisms by automati- 
cally deleting information copies after their receipt. 20 

TECHNICAL BACKGROUND OF THE 
INVENTION 

Email is a very useful tool for promoting communication 
between people who are separated by distance, by different 
working hours, or both. However, email is sometimes incon- 
venient for recipients. This hinders the use of email as a 
mechanism for broad -casting information to many people 
and/or transmitting information to one or a few specific 
targets. 

Email creates annoyances which have not been fully 
addressed. One common source of annoyance Ls "spam" 
email, namely, unsolicited email sent to multiple recipients. 
Unlike passive advertising, such as pop-up and banner ads 35 
on websites, and ads in more traditional print, radio, or 
television media, "spam" email seeks out its audience, and 
thrusts itself into the viewer's field of attention without 
being invited. This can be very annoying because it inter- 
rupts other activities, consumes system resources, and per- 40 
haps most importantly, requires active efforts by recipients 
who want to dispose of these unwanted messages. An email 
recipient may delete unwanted messages manually by using 
an email Delete command in an email client (e.g., a desktop 
application program, or web mail pages in a web browser), 45 
by dragging the messages in question to a trash can, or by 
similar steps. 

Some email systems provide filters that detect at least 
some incoming unsohcited email and either deletes it or, 
more typically, places it in a directory or folder reserved for 50 
such messages. But filters sometimes err, either by charac- 
terizing as unsolicited email a message that is not, or by 
failing to delect unsolicited email and letting it through with 
the normal correspondence from familiar senders. Thus, it 
would be helpful to provide some alternate or additional 55 
means for disposing of unsolicited email. 

Some unsolicited email includes a statement that sending 
a reply with "REMOVE" in the subject field will remove the 
recipient from the mailing list. It has been alleged, however, 
that any reply to some such unsolicited email will simply 60 
confirm that the address to which the unsolicited mail was 
sent is "good" (meaning someone actually looked at the 
unsolicited email) and that a reply asking to be removed 
from the maihng list may therefore have an effect opposite 
from the intended effect. If this is so, then only addresses 65 
from which no reply is received would have a chance of 
being removed from the list. 
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Moreover, even some mail which is unsolicited is of 
interest to the recipient only for a limited time. For instance, 
the fact that a recipient has voluntarily subscribed to an 
electronic newsletter, a news service, or a listserv list docs 
not necessarily mean that the recipient wants to keep every 
message from that subscription after reading it. Indeed, 
despite having subscribed to the service, the recipient may 
not even want to read each and every message from the 
subscription service. 

Television and radio "spots" which broadcast an adver- 
tisement without taking up storage space on the receiver 
(televisions and radios generally lack permanent storage 
such as hard disks) are known, although thus characterization 
of them as not requiring recipient storage resources and 
proactive deletion by the recipient may be new. 

Accordingly, it would be an advancement to provide an 
improved approach to email and similar messaging which 
moves the email message disposal burden off the shoulders 
of the recipient. In particular and without limitation, it would 
be an advance to make public notices and news sent through 
email less onerous to recipients, and likewise to make email 
advertisements (including without limitation coupons, con- 
tact information, descriptions of goods and/or services, 
comparisons, and promotional materials) available to mul- 
tiple recipients without requiring that recipients affirma- 
tively remove unwanted advertisements from their computer 
systems or create a reply message having REMOVE or 
another keyword in the subject, to indicate their lack of 
interest in the subject matter being advertised. 

Such approaches for improved email messaging are dis- 
closed and claimed herein. 

BRIEF SUMMARY OF THE INVENTION 

The present invention relates to methods, articles, signals, 
and systems for self-removing email messages. Self- 
removal of email (or other transmitted digital information 
presentations) can provide at least two advantages. First, 
self-removing email can be used to enhance the security of 
a system by reducing the number of message copies and the 
life span of those copies. Second, self- re moving email can 
be used to reduce the inconvenience of unsolicited email by 
making it possible for oflicials, advertisers, and other broad- 
cast email originators to present messages that do not have 
to be manually removed by the target audience. A given 
method, article, signal, or system may use self-removing 
email to enhance message security, to reduce recipient 
annoyance, or both. 

In some embodiments, self-removing email messages are 
encrypted with conventional tools and techniques. To further 
enhance security, a message is closely coupled to executable 
code which reduces the number of copies of the message. 
Some versions of the code allow any given copy of the 
message to be viewed at most once. 

In some embodiments, self-removing email messages 
contain advertisements, but the invention may also be used 
to broadcast or otherwise transmit self-removing email 
messages which contain other materials that, at least by 
default, are not stored long-term on the recipient's hard disk 
or on other intervening nodes (the self-removal action may 
sometimes be expressly overridden). For instance, news 
items, confidential materials, and other materials directed to 
a limited audience such as pubHc notices (changes in the 
law, election results, tax auction notices, public hearing 
announcements, and so on), private club notices, and mate- 
rials intended for mature audiences, may also be transmitted 
in self-removing email messages. 
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Unlike traditional email, self-removing email places the purpose processing device such as an ASIC, PAL, PLA, 
burden of selecting messages for removal and then removing PLD, or other customized or programmable device. The 
them on the software and on the message originator, instead memory may include static RAM, dynamic RAM, flash 
of on the message recipient. "Spam" advertising methods memory, ROM, CD-ROM, disk, tape, magnetic, optical, or 
become much less onerous to recipients if the email carrying 5 another computer storage medium. The input device(s) may 
the advertisements is as effortlessly ephemeral (from the include a keyboard, mouse, touch screen, light pen, tablet, 
recipient's point of view) as a television or radio commer- microphone, position sensor, pressure sensor, thermal 
cial. Other aspects and advantages of the present invention sensor, or other input hardware with accompanying firm- 
will become more fully apparent through the following ware and/or software. The output device(s) may include a 
description. 30 monitor or other display, printer, speech or text synthesizer, 

solenoid, switch, signal line, or other process controller. 

BRIEF DESCRIPTION OF THE DRAWINGS xhe network 102, which is also by itself one of the many 

To illustrate the manner in which the advantages and networks suitable for use with the invention, includes a 

features of the invention are obtained, a more particular server 108 and several clients 110. Other suitable networks 

description of the invention will be given with reference to 15 may contam other combmations of servers, clients, and/or 

the attached drawings. These drawings only illustrate peer-to-peer nodes, and a given computer may function both 

selected aspects of the invention and thus do not limit the as a client and as a server. For mstance, network 104 is a 

invention's scope. In the drawings: peer-to-peer network. The computers 106 connected by a 

. -11 . . A ♦ suitable network may be work-stations, laptop computers 

no. 1 .s a diagrara illustrating computers and computer disconnectable mobile compulets, servers/mainframes, 

networks suitable for use according to the mvention by ^^^^ j.^,^, 

means of configuration with special-purpose hardware and/ . [ u a u a - ^ u- 

„ j Lj. • assistants or hand-held computing devices 114, or a combi- 

or software described herein. *■ *u f r o 

nation thereof. 

FIG. 2 is a data flow diagram illustrating a method, signal, ^ j^j^^j oetwork such as network 102 or network 104 may 

and environment using self-removing messages to carry ^5 include communications or networking software such as the 

messages from an ongmator through a network to one or software available from Novell, Microsoft, Artisoft, and 

more recipients. other vendors. A larger network such as the network 100, 

FIG. 3 is a data flow diagram further iUustrating embodi- may combine smaller network(s) and/or devices such as 

ments of the invention used to increase recipient routers and bridges 116. Large or small, the networks may 

convenience, and also further illustrating removal indicators 30 operate using TCP/IP, SPX, IPX, and other protocols over 

and removal code shown in FIG. 2. twisted pair, coaxial, or optical fiber cables, telephone lines, 

HFTAIT Fn nF^irRTPTTON OF THF satellites, microwave relays, modulated AC power lines, 

PREFERRED EMBODIMENIS ^.^^ „^.^^^„ j^^^ ^^^^^ ^j^jl .^^ ^j^^ ^^.^ 

In describing methods, devices, and systems according to 35 convenience "wires" includes infrared, radio frequency, and 

the invention, the meaning of several important terms is other wireless links or connections. Like the network 100, a 

clarified, so the claims must be read with careful attention to suitable network may encompass smaller networks, 

these clarifications. Specific examples are given to illustrate Alternatively, or in addition, a suitable network may be 

aspects of the invention, but those of skill in the relevant connectable to other networks through a gateway or similar 

art(s) will understand that other examples may also fall 40 mechanism. 

within the meaning of the terms used, and hence within the At least one of the computers 106 is capable of using a 

scope of one or more claims. Important terms are defined, floppy drive, tape drive, optical drive, magneto-optical 

either exphcitly or implicitly, both here in the Detailed drive, or other means to read a storage medium 120. A 

Description and elsewhere in the application file. suitable storage medium 120 includes a magnetic, optical, or 

Computers, Networks 45 other computer-readable storage device having a specific 

The invention may be used to protect and/or ultimately physical configuration. Suitable storage devices include 

remove email messages from an individual computer or floppy disks, hard disks, tape, CD-ROMs, PROMs, random 

from one or more computers in a network, including copies access memory, flash memory, and other computer system 

of messages stored on removable media or transmitted over storage devices. The physical configuration represents data 

a network link and stored on intermediate nodes. FIG. 1 50 and instructions which cause the computer system to operate 

illustrates a system 100 having several computers and sev- in a specific and predefined manner as described herein, 

eral networks 102, 104, 116 which can be configured accord- llius, the medium 120 tangibly embodies a program, 

ing to the invention, but those of skill in the art will functions, and/or instructions that are executable by 

understand thai suitable computer networks include various computer(s) to protect and/or delete email message contents 

networks, such as local area networks, wide area networks, 55 substantially as described herein. 

metropohtan area networks, and/or various "Internet" or IP Suitable software languages and tools to assist in imple- 

net works such as the World Wide Web, a private Internet, a menting the various devices, signals, systems, and methods 

secure Internet, a value-added network, a virtual private of the invention are readily employed by those of skill in the 

network, an extranet, or an intranet. pertinent art(s) using the teachings presented here and 

The system 100 shown as an example in FIG. 1 includes 60 programming languages and tools such as Java, Pascal, C++, 

two local area networks 102, 104. Each network 102, 104 C, Perl, database languages, APIs, various system level 

includes at least one computer 106, and each computer 106 SDKs, assembly, firmware, microcode, and/or other lan- 

includes at least a processor and a memory; computers 106 guages and tools. 

also include various input devices and/or output devices. Personal Messaging with Self-Removing Messages 

The processor may include a general purpose device such as 65 FIG. 2 iUustrates a method and environment using self- 

a 80x86, Pentium (mark of Intel), 680x0, or other "off-the- removing messages to carry messages from an originator 

shelf microprocessor. The processor may include a special 200 at some origin to one or a few recipients 202. As used 
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here, "a few" meaas less than ten recipients, or alternatively, 
a snaall number of recipients who are personally known to 
the originator; news items, notices, advertisements and/or 
other messages directed to more than a few recipients are 
discussed elsewhere herein, although many of the tools and 5 
techniques taught herein apply regardless of whether there 
are only a few recipients. 

During a creating step 204 the originator 200 creates a 
self- removing message 206 using software and hardware 
configured by the software, or using custom hardware alone, 
according to the teachings herein. This may be done gener- 
ally in accordance with familiar tools and techniques for 
email messaging, attaching files, embedding graphics, 
encrypting data, and/or compressing data, but it must asso- 
ciate code and/or hardware 208, and/or indicators 210, with 
the message 206 to perform or facilitate the self-removal 
message management functions described here. That is, the 
originator 200 (or equivalently, an embodiment under the 
originator *s direction) marks the message 206 at the origin, 
includes removal code 208 in the message 206, or does both. 
The code 208 may be embedded solely in the message 206, 20 
but it may also be embedded in plug-ins, modules, routines, 
objects, threads, or other forms in an ISP's transmission 
program 224 and/or a recipient's browser or email reception 
program 226, or the code 208 may be divided between one 
or more such locations. Code and/or hardware 208, and 25 
indicators 210, are collectively termed "self-removal 
enhancements" herein. 

In addition to the message self-removal code 208 in the 
message 206 and/or elsewhere, the message 206 often 
includes one or more self-removal indicators 210 such as 
bitflags, header values, file name extensions, or other data 
marking the message 206, thereby identifying the entire 
message 206 or a portion thereof to the removal code 208 
and distinguishing the message 206 from messages which 
are not subject to removal by the means taught herein. Of 
course, in a system where all messages are entirely self- 
removing, the indicators 210 are optional unless they are 
needed to detail information such as how long to display the 
message contents to the recipient, whether to allow recipi- 
ents to scroll back through a previously displayed portion of 
the message contents, and so on. However, batch files, 40 
message handling rules, and other deletion controls that are 
provided by the recipient 202 are not indicators 210, since 
they do not give originators 200 and/or distributors 222 the 
responsibility for, and the initial control over, removal of 
messages at the recipient's location. 45 

In embodiments preferred for this present application, the 
originator 2(M) or an embodiment under the originator's 
direction marks the message 206 at the origin with one or 
more indicators 210 to facilitate the self-removal message 
management functions described here. In these 50 
embodiments, removal code 208 is not included in the 
message 206. Instead, removal code 208 is embedded in 
plug-ins, modules, routines, objects, threads, or other forms 
in a recipient's browser or email reception program 226. 
However, the initial decision to make a given message be 55 
self-removing still rests with the originator 200 (or with an 
ISP 222), rather than making the recipient 202 actively 
delete the message. 

In these presently preferred embodiments, self-removal 
indicators 210 in a given email message 206 permit the 60 
originator 200 and/or an intermediate node 220 to indicate to 
the removal code 208 one or more of the following options: 

(a) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
shortly after being opened by that recipient, e.g., delete 65 
the message approximately five minutes after it is 
opened; 
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(b) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
no later than a specified time after being opened by that 
recipient, and may be deleted before that specified time, 
e.g., delete the message within 24 hours of receiving it; 

(c) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
no sooner than a specified time after being opened by 
that recipient, and may be deleted any time after that 
specified time, , e.g., give the recipient 24 hours to 
make copies, reply, forward the message or otherwise 
react to the message 206, but delete it after that 
specified time has elapsed; 

(d) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
no sooner than a first specified time after being opened 
by that recipient, and no later than a second specified 
time after being opened, e.g., delete the message within 
one to seven days of receiving it; 

(e) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
no later than a specified time after being received, 
regardless of whether it has been opened by that 
recipient; 

(f) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
no sooner than a specified time after being received, 
regardless of whether it has been opened by that 
recipient; 

(g) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
between a first and second specified time after being 
received, regardless of whether it has been opened by 
that recipient; 

(h) the message 206 is to be deleted automatically by the 
removal code 208 according to some combination of 
chronological and/or "has been opened" criteria gen- 
erally as discussed above, but the chronological crite- 
rion is a fixed time or date, rather than an elapsed time, 
e.g., delete the message 206 no later than Jul. 4, 2001 
regardless of whether it has been opened by that date; 

(i) the message 206 is to be deleted automatically by the 
removal code 208 according to some combination of 
chronological and/or "has been opened" criteria gen- 
erally as discussed above, but instead of deleting the 
message only if it has been opened, or deleting it 
regardless of whether it has been opened, delete the 
message only if it has not been opened, e.g., if the 
recipient doesn't bother to open the message 206 
because the subject line indicates it is an unwanted 
solicitation, then the message will be deleted automati- 
cally approximately one week after it was received; 

(j) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox, 
after it has been opened, when a specified storage 
limitation is reached, e.g., too many messages or too 
much storage used for messages; 
(k) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
when a specified storage limitation is reached, regard- 
less of whether it has been opened by that recipient; 
(1) the message 206 is to be deleted automatically by the 
removal code 208 from each recipient's mailbox/inbox 
when the next message is received from the same 
source, regardless of whether the first message from 
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that source has been opened by that recipient, e.g., providers such as America Online both the opportunity and 

automatically keep for the recipient only the latest news the presumed burden of marking for removal at least some 

item from a newsletter subscription; of the messages 206 they originate or distribute. In conven- 

Note that conventional options for handling attachments tional email systems, by contrast, recipients are burdened 

may be combined with the removal indicators 210. For 5 with removing essentially all unwanted messages. The 

instance, conventional email clients such as the Eudora Pro invention promotes efiBciency by having the originator 200 

3.0 program permit one to specify whether an attachment to and/or distributor 222, who know the message contents 212 

a message should be deleted when the message is manually and their intended effect, mark the messages 206 for removal 

deleted. In the present invention, a similar option can specify after their arrival. This is better than making one or many 

whether to keep attachments when a self- removing message ao recipients, who did not necessarily ask to receive the 

206 is automatically deleted. message, attend to its disposal. 

Note that actions somewhat like these may be taken by a The invention also gives originators 200 and/or distribu- 

recipient, without any express removal indicator 210 in an tors 222 a choice regarding the transience of their message 

email message. For instance, a recipient's email client 226 content 212 at the recipient's location. In conventional chat 

could be configured to automatically delete any message 35 rooms and instant messaging systems, by contrast, messages 

which remains unopened for more than one week. Likewise, are ephemeral at the recipient's station regardless of whether 

a recipient's email client 226 could be configured to make the originator or distributor wishes them to persist there, 

automatic deletion of a message be the default disposition because they often scroll off the visible display window or 

after the message has been opened. That is, the recipient screen until they arc beyond the recipient's reach, 

must manually save desired messages, unlike the conven- 20 During one or more transmitting steps 218 the message 

tional approach in which recipients must manually delete 206 is transmitted over the signal means 118 from the 

undesired messages. originator 200 to the recipient(s) 202, possibly via a dis- 

However, to clearly shift the burden of message removal tributor 222. This may be done generally in accordance with 
from recipients 202 to originators 200 and/or distributors familiar tools and techniques for packet formation, storage, 
222, the message 206 includes one or more express removal 25 forwarding, error handling, and/or other network 100 trans- 
indicators 210 which are placed there by the originators 200 mission means. As the message 206 travels over one or more 
and/or distributors 222 to make removal of the message 202 networks, transmission software and/or hardware in bridges 
an automatic default result. The actual deletion is performed and/or routers 116, servers 108 (including without limitation 
by the recipient's software 226, but this is done in response ISP servers and application servers), and other network 
to the instructions 210 from the originator 200 and/or 30 intermediate nodes 220 have access to part of all of the 
distributor 222. Thus, a message subject line such as "GET message. This access is facihtated by and/or subject to 
Riai" or "HOT STOCK TIP" is not a removal indicator control by distributors 222, namely, ISPs (and other access 
210, even if the recipient has installed a filter that deletes providers), other authorities, including governmental 
messages containing that subject line, unless the message authorities, and other parties who are neither the message's 
originator places the subject line in the message with the 35 originator nor the message's intended ultimate recipient, 
expectation that the recipient's email tool 226 will automati- The nodes 220 operate at least in part using conventional 
cally delete the message in response to the subject line. Such networking tools and techniques 224. After they have for- 
subject lines are conventionally used to provoke an inquiry warded or otherwise processed in a conventional manner 
or another email reply, not to ensure that the message will be those portions, these novel intermediate nodes 220 can then 
automatically deleted by the recipient's software. 40 delete, shred, or otherwise enhance the security of the 

In short, a removal indicator 210 provides an originator message 206 portions by removing them as taught herein. 

200 and/or a distributor 222 with initial control over the ISPs and other message distributors 222 may simply 

deletion of a message after the message reaches the recipient forward messages 206. However, the nodes 220 may also be 

202. The control is "initial" in that, in some cases the enhanced according to the present invention. For instance, 

recipient may override the instructions 210 of the originator 45 message removal software and/or hardware 208 may con- 

200 and/or distributor 222, such as by saving message figure the intermediate nodes 220 to provide novel capabili- 

content 212 that would otherwise be automatically deleted. lies which include identifying packets or other message 206 

But the default handling of the message 206, i.e., the portions, up to and including the entire message 206, 

handling in the absence of intervention by the recipient 202, through the self-removal indicators 210 and/or modifying 

is specified by the originator 200 and/or a distributor 222 via so messages 206. 

the removal indicator(s) 210. For instance, distributors 222 may verify that email mes- 
Wic message 206 normally includes content 212 which is sages 206 from a given originator 200 contain agreed-upon 
meant to convey information from the originator 200 to the removal indicators 210. In particular, for the convenience of 
recipient(s) 202. The message content 212 may be in the advertising message recipients, a distributor 222 may grant 
form of text (e.g., word processor documents), images (e.g., 55 use of a member list of email addresses for limited adver- 
still or motion image or video files), sounds (e.g., MP3, tising purposes on condition that the emailed advertisements 
WAV, or other aural files), or other sensible items, and it may contain indicators 210 which will cause them to be auto- 
be in-line and/or provided as attachments. Word processors, matically removed. The distributor 222 may then check 
conventional email tools, and other familiar tools and tech- some or all of the messages 206 to verify compliance with 
niques may be used to select and/or create the message 60 that contractual requirement. 

content 212. Alternately, the agreed-upon removal indicators 210 may 

The message 206 optionally includes display code 214 be actually inserted by the distributor 222, pursuant to a 

and/or security code 216, each of which is discussed further contractual requirement or to distributor 222 operating 

below. policy. Identification of messages for indicator 210 insertion 

Unlike previous email systems, chat rooms, and other 65 may be based on the originator's email address, on the 

conventional messaging systems, the present invention thus subject line of the message, and/or on other filtering criteria. 

gives email message originators 200 and/or major service For iaslance, an access provider 222 may insert removal 
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indicators 210 in all messages (regardless of originalioo herein. Messages 206 may also be removed after being only 
address) which contain "$$$" in the subject line, so that partly displayed, or after sufiScient time passes or some other 
those messages are automatically deleted one day after being event occurs, such as a reboot, or an browser restart, 
opened or one week after being received, whichever occurs Broadcasting with Self-Removing Messages 
first. 5 The novel tools and techniques illustrated in FIG. 2 can 
For instance, an access provider 222 such as AOL, also be used when the originator 200 sends a self- removing 
CompuServe, or Prodigy may permit controlled mailings to message 206 to more than a few recipients 202. For instance, 
its members on condition that each message 206 include an public agencies and private litigants may wish to send 
indicator 210 that will cause the message 206 to be auto- messages 206 containing legal notices of the type which are 
matically removed from the recipient member's email "In 10 conventionally published in newspapers. In the case of 
Box** after the recipient member 202 opens it, unless the public agencies, email address databases could be compiled 
recipient 202 actively overrides that removal to save the in connection with tax payments, corporate and professional 
message's contents 212. Likewise, an ISP could use indi- license registrations and renewals, driver license registra- 
cators 210 to implement a promLse that authorized email tions and renewals, and similar governmental functions, 
advertisements will consume no more than one half- 15 Care would be taken (and appropriate legislation and/or 
megabyte of a recipient's hard drive, by having the indica- regulations put in place) to limit or prevent the use of such 
tors 210 set to cause automatic deletion of messages from a governmental email address databases by private or quasi- 
given list of sources, thereby freeing drive space, when the private entities. 

total space used by all messages from those sources exceeds However, private entities may appropriately use the 
a storage hmit of one half-megabyte. Indicators 210 could 20 invention, in accordance with applicable law, to broadcast 
likewise indicate that self -removing messages 206 should be self-removing messages 206 to large target audiences. For 
removed when the hard drive or partition holding them has instance, a business might send registered customers new 
only a specified amount of free space left, or when a product announcements or press releases. Likewise, a pri- 
specified percentage of the total drive/partition space vate club or organization (or a business) might send event 
becomes used. 25 announcements to its members (or prospects) using self- 
In some embodiments, the email tool 226 warns users that removing messages 206. Subscribers to newsletters or other 
messages 206 are subject to automatic deletion. news services may also receive news items in the content 
Accordingly, a message 206 which meets the automatic 212 of self-removing messages 206. 
removal criteria (e.g., "$$S" in the subject line) can be Advertising and News with Self-Removing Messages 
preserved by the recipient 202 if they so desire, despite the 30 One email broadcast use of particular interest to busi- 
inscrtion of removal indicators 210 by the access provider nesses is the use of email for advertising. Another broadcast 
222 and/or by the message originator 200. use is email news, in the form of newsletters, article sum- 
Eventually a transmission step 218 brings the message maries with links to articles on web pages, and the like. Such 
206 to a recipient's station 226. This may be done generally advertising and news broadcasts may be mass market, or 
in accordance with familiar tools and techniques, including 35 targeted demographic, or still more focused, as when a list 
without limitation web browsers and email programs of previous customer email addresses is used. However, 
adapted with at least removal code 208 according to the conventional email advertising and news updates impose on 
invention through plug-ins or other means, and protocols the recipient at the same time, sometimes doing so even as 
such as SMTP, MIME, POP, I MAP, Privacy Enhanced Mail, they directly or indirectly solicit business from the recipient. 
lisLserv protocols, and Usenet protocols. At the recipient's 40 Conventional approaches also consume storage on interme- 
station 226 the message 206 is optionally authenticated 228, diate network nodes, thereby imposing on Internet Service 
optionally decrypted 230, displayed 232, removed 234 by Providers and similar entities (AOL, CompuServe, Prodigy, 
removal code 208 operating in response to message indica- and so on). 

tors 210 in the message 206, and optionally acknowledged By shifting the burden of message disposal away from 

236. Each of these steps is discussed at various points 45 recipients 202 and onto the system 100 and the originator 

herein; at present, the focus is on the displaying step 232 and 200, the invention reduces the tension created by simulta- 

the removing step 234. neously imposing on the recipient to dispose of the message 

During the displaying step 232, the message content 212 and asking the recipient to investigate or purchase the 

is displayed 232 to the recipient 202. This may be done advertised products or services, or to visit the news provid- 

immediately upon arrival of the message 206 without 50 er's web site, which often carries advertising. Reducing this 

prompting from the recipient 202, or it may occur as a result tension will make direct and indirect email advertising better 

of the message's icon or title being highlighted, opened, received and hence more effective. 

clicked on, or otherwise activated by the recipient 202. The In one embodiment, self-removing email messages 206 
displaying step 232 may limit message contenLs.212 to contain advertisements of any of a broad range of services 
volatile memory (as opposed to disk or other non-volatile 55 and goods which are presently described in unsolicited 
storage), may prevent forwarding of the message 206, may mass-mailing emails, in website banner ads, in television or 
disable screen save functionality, may overwrite the mes- radio spots, in newspapers and magazines, and in other 
sage contents 212 shortly after displaying them, may give forms and media. In one embodiment, they contain news 
the recipient 202 the option of overriding some or all of items which are mailed to subscribers who voluntarily 
these default settings, and so on, as described herein. In 60 provided their email addresses for that purpose. Unlike 
particular, the recipient 202 may be warned that the message television, radio, newspapers, and magazines, ads and news 
206 is subject to automatic removal. sent through the Internet and other electronic media can be 
Finally, the message 206 is removed 234 by overwriting relatively inexpensive, targeted, interactive, and/or provide 
the window or screen that displayed it, by deleting it or hot links to web sites, newsgroups, IRC channels, and other 
otherwise moving it from an In Box to a Trash folder or the 65 digital network resources. Like unsolicited emails and ban- 
like, by marking the space it occupies as free, by erasing its ner ads, the messages 206 can be animated, with audio 
contents from disk, and/or in other ways, as discussed and/or visual components, and hot links. Unlike unsolicited 
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emails and some banner ads, the self -removing message files 
206 of the present invention do not require that recipients 
202 aflBrmatively remove unwanted ads or old news from 
their computer system disk or create a reply message having 
REMOVE in the subject, to indicate their lack of interest in 5 
the subject matter being advertised, to conserve space, 
and/or to reduce clutter in their inbox. 

Self-removing email tools and techniques described 
herein can also be used to broadcast, multicast, or otherwise 
transmit explicit (intended for mature audiences only) mate- 
rials without requiring permanent storage of such materials 
on the recipient's computer system. Some people 200, 202 
may find this useful for medical or health discussions, such 
as support groups and professionals dealing with the difficult 
personal and social issues arising from conditions such as 
breast cancer or acquired immune deficiency syndrome. 
Some people may also find this useful for personal enter- 
tainment using sexually explicit materials. Within the 
bounds allowed by law, the invention may assist such uses. 
Examples Focused on Recipient Convenience 

FIG. 3 illustrates a subset of the embodiments illustrated 20 
in FIGS. 1 and 2. Except as noted otherwise below, the 
illustrated steps and components are as described elsewhere 
herein. However, these embodiments focus on increasing 
convenience to the recipient through automatic removal of 
messages, rather than increasing security through such 25 
removal. Although security measures such as encryption, 
security code 216, secure deletion in the form of electronic 
shredding, atomicity in display code 214, incremental over- 
writes while incrementally displaying message content, 
Print Screen disabling, message self-modification, searches 30 
for additional message copies, and authentication may be 
employed in embodiments according to FIG. 3, they are not 
central to the invention in such embodiments. 

FIG. 3 also further illustrates the removal indicators 210, 
which may be used in embodiments according to any of the 35 
Figures. Four sample categories of indicators 210 are shown. 
A first category of indicators 300 includes indicators 210 
which control automatic message 206 removal according to 
whether the message 206 has been opened by the recipient 
202. For instance, an indicator 300 may specify that the 40 
message 206 is to be deleted automatically by the removal 
code 208 from each recipient's mailbox/inbox within one to 
seven days of when the recipient 202 opens the message 206 
to read it. 

A second category of indicators 302 includes indicators 45 
210 which control automatic message 206 removal accord- 
ing to whether a fixed time and/or date has been reached, or 
a specified time has elapsed since some event such as 
original transmission of the message, receipt of the message, 
or first opening of the message. For instance, an indicator 50 
302 may specify that the message 206 is to be deleted 
automatically by the removal code 208 from each recipient's 
mailbox/inbox on Dec. 31, 2001. 

A third category of indicators 304 includes indicators 210 
which control automatic message 206 removal according to 55 
conditions involving a replacement message. A replacement 
message replaces a prior message, so the prior message is 
deleted. For instance, an indicator 304 may specify that the 
message 206 is to be deleted automatically by the removal 
code 208 firom a recipient's mailbox/inbox after that recipi- 60 
ent receives the next message from LawPlusPlus.com with 
"Update" in the subject. Similarly, an indicator 304 may 
specify that a message 206 is to be deleted automatically by 
the removal code 208 from a recipient's mailbox/inbox if a 
replacement message is not received by the recipient 202 by 65 
a specified date or within a specified period after the first 
message 206 is received. 
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Earlier message(s) to be replaced may be identified in the 
replacement message by one or more values such as source 
address, date, or subject line. Messages being replaced are 
preferably also identified by a key, certificate, password, or 
other authentication mechanism presented by the replace- 
ment message to the removal code 208, in order to discour- 
age malicious "replacement" messages which are actually 
sent to delete unrelated earlier messages. 

A fourth category of indicators 306 includes indicators 
210 which control automatic message 206 removal accord- 
ing to whether a storage limit has been reached. For instance, 
an indicator 306 may specify that the message 206 is to be 
deleted automatically by the removal code 208 from each 
recipient's mailbox/inbox after the number of saved mes- 
sages in a specified folder reaches one thousand, or after the 
amount of disk space taken by the saved messages reaches 
three megabytes, or when the disk partition has less than one 
megabyte of free space left. 

A given indicator 210 may belong to more than one 
category. For instance, an indicator may specify that the 
message is to be automatically removed when a replacement 
message arrives or one week after being opened, whichever 
occurs first. 

More generally, FIG. 3 illustrates methods for using 
self-removing messages 206 to make email messaging more 
convenient for message recipients by shifting the burden of 
message removal from the message recipient 202 to at least 
one of the message originator 200 and the message distribu- 
tor 222. Through removal indicators 210 and/or removal 
code 208 which is associated with message content 212 by 
the message originator 200 and/or the message distributor 
222, the methods provide the message originator 200 and/or 
the message distributor 222 with initial control over the 
deletion of a recipient copy of the message content 212 after 
that content and the self-removal enhancement reach the 
recipient 202. Unlike prior approaches, the message content 
copy at the recipient's location may be automatically deleted 
in response to various criteria, even if the message contain- 
ing the content 212 has already been opened by the recipient 
202. As with other methods of the invention, the methods 
illustrated by FIG. 3 may be embodied in software which 
configures a computer storage medium such as a CD, floppy 
disk, hard drive, ROM, or RAM. 

The methods associate message content 212 with a self- 
removal enhancement such as one or more self-removing 
message indicators 210. The association between the mes- 
sage contents 212 and the self-removal enhancement is 
made by the message originator 200, by the message dis- 
tributor 222, or both. It may be performed by placing 
removal code 208 in the message (e.g., as an attachment). 
But it is preferably performed by placing one or more 
removal indicators 210 in the message (e.g., in an email 
header or an email subject line) with the content 212. 

In alternative embodiments, the method does not place the 
self-removal enhancement in the same message as the 
content 212 that is thus made subject to removal. Instead, the 
method may associate message content 212 with a self- 
removal enhancement by placing the enhancement in an 
email message 206 which identifies a separate message, if 
the content 212 is provided in the separate message. That is, 
the association may be made by sending the email message 
contents 212 in one partial transmission 218 to the recipient 
202 and sending the self -removal enhancement in a separate 
partial transmission 218 (before or after the content 212 is 
sent), and by ensuring that the enhancement portion of the 
transmission 218 permits identification of the intended con- 
tent 212. For instance, an ISP 222 may transmit to its 
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member email tools 226 an instruction which indicates that removal. Check determining triggering criteria may also 

any subsequent message from an email address specified in identify the message as one that originates as part of a mass 

the instruction should be subject to automatic removal one mailing that was not expressly authorized. In that case, the 

day after being opened, and that the recipient should be invention provides the distributor 222 with an option less 

warned of this when such a message is opened, 5 extreme than the conventional choice of either (i) allowing 

As with other methods of the invention, the methods the mailing to continue as is, or (ii) attempting to block it 

illustrated in FIG. 3 may be used with various types of entirely. Instead, the messages that were not previously 

content 212 in a variety of private, governmental, and/or self-removing can be modified by or for the distributor 222 

commercial contexts. If the contents 212 include to add a self-removal enhancement, so that recipients 202 

advertising, for instance, then the methods may obtain an lo receive the messages but are not unduly inconvenienced by 

email address for the recipient 202 from an email address them. Conversely, the distributor 222 etc. may strip out 

database containing many addresses. Of course, the contents self-removal enhancements, so that messages 206 are modi- 

212 may contain various types of information, including fied to become not self-removing. 

advertisements, notices, news items, links to a web site, and If the checking step at the node 220 determines that the 

other content, including content identified elsewhere herein 15 message contains or is otherwise subject to a self-removing 

and/or content used in conventional messaging systems and message indicator 210 as expected, then the node 220 

methods. transmits the message 206 on toward the recipient 202. But 

Inventive methods may be employed by the distributor if the checking step determines that the message does not 

222, or by an authorized agent/subcontractor/service/etc. contain indicator(s) 210 as expected, then the message may 

acting for the distributor 222, to verify that self -removing 20 be blocked to prevent further transmittal to the recipient 202, 

messages 206 are being used to shift the burden of message e.g., by being deleted, dropped, or rerouted back to the 

removal from message recipients 202. For instance, as originator. Alternately, the lack of expected indicator(s) 210 

indicated generally in FIGS. 2 and 3, in some systems the may be remedied by inserting one or more indicators 210 in 

distributor 222 receives at one or more intermediate nodes the message and then transmitting the resulting message 206 

220 a message intended for the recipient 202.1116 distributor 25 from the intermediate node 220 toward the recipient 202. 

222 etc. may use software 208 to check the message to At the recipient 202 (e.g., at the recipient's mail server 

determine whether the message contains a self-removing and/or at the recipient's laptop, wireless device, or other 

message indicator 210. This may check for a particular workstation), removal code 208 checks incoming messages 

indicator 210, or for more than one indicator 210, or for at to determine whether they contain any self-removing mes- 

least one indicator 210 from a specified group of indicators 30 sage indicators 210 from message originators 200 and/or 

210. Checks for . indicator(s) 210 may be performed by message distributors 222. The removal code 208 then auto - 

reading the email header, email subject line, and/or other matically notifies the recipient 202, removes messages 206, 

expected location(s) of the indicator(s) 210. and otherwise proceeds in response lo such indicators 210 

The check for a self- removal enhancement in a given with each message 206 which contains or is otherwise 

message may be triggered by one or more one predeter- 35 associated with an indicator 210. Note that deletion instruc- 

mined check triggering criteria which indicate that a self- tions provided by the recipient 202 are not indicators 210, 

removing message indicator 210 should be present. A self- since they do not give originators 200 and/or distributors 

removing message indicator 210 itself is not a triggering 222 responsibility for, and initial control over, removal of 

criterion. In some cases, an indicator 210 or other self- messages at the recipient's location, 

removal enhancement is expected because the message is 40 Additional Examples 

from an entity that has an agreement with the distributor 222 Additional details regarding various embodiments of the 

permitting mass mailings through the distributor 222 subject present invention are provided below; "embodiment" refers 

to use of the self-removal enhancement. For instance, the to any system, method, signal, or configured medium 

message may come from a source address on a list of according to the invention. Discussions of a given embodi- 

advertisers who have mailing contracts with the distributor 45 ment also apply to other embodiments unless indicated 

222 or a license to use the distributor's membership email otherwise to one of skill in the art, 

database. In one embodiment, a self- removing email file includes 

In other cases, a self-removal enhancement is not several message components 206 which display themselves 

expected but should nonetheless be present because the in groups of one or more components each, and then 

message is part of an unauthorized mass mailing. The check 50 self-remove 234 the displayed 232 components. The display 

triggering criteria may include criteria for detecting "spam" 232 of a given group may be triggered by an event such as 

email through random sampling, conventional traffic arrival at the recipient's system 226, the opening of an outer 

monitoring, suspicious address monitoring, and the like. For email envelope, the launching of a certain application, the 

instance, the message may contain keywords or phrases that passage of a predetermined time period, or the arrival of a 

suggest it should be subject to automatic removal for the ss predetermined date. 

recipients' convenience. The message may have come from In one embodiment, a self-removing email file's self- 

a source address that is sending a large number of messages removal property can be expressly overridden by the sender 

in a short time, or from an address that is responsible for 200, by the recipient 202, by an intervening authority 222 

numerous messages to nonfunctional destination addresses such as an ISP or an authorized government agency, or by 

("bounced" messages arising from use of an email database 60 some combination of these. In some cases, the override is 

containing many incorrect or obsolete addresses). silent, and in others the sender 200 or recipient 202 or both 

In short, check triggering criteria used by or for the are automatically notified of the override, 

distributor 222 may identify the message as one that origi- In some embodiments, a reply email (self- removing or 

nates with an authorized advertiser or another authorized not) is sent 236 automatically lo the sender 200 when the 

entity. In this case, the invention allows the distributor 222 65 recipient 202 has opened the self-removing email message 

to monitor compliance with distributor contracts and/or 206. In some cases, the possibility of a reply is an explicit 

policies, laws, or regulations that require automatic message option presented to the user 200 or 202; in some of these 
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cases, the options presented include one to send 236 a reply 
asking that the recipient 202 be removed from the mailing 
list. This allows the recipient 202 to request removal by 
doing little or nothing more than opening the unsolicited 
message 206 and clicking on a "REMOVE FROM MAIL- 
ING LIST" box or button. In some embodiments, the 
recipient 202 is given the option of inserting text or other 
digital material in the reply. 

In one embodiment, a message to be emailed is embedded 
in an executable (interpretable, etc.) file and the file 206 is 
emailed. When the recipient 202 tries to open the message 
206 the executable portion runs an authentication operation 
228. If the recipient 202 is authorized and the message file 
206 has not already been opened, then an executable portion 
214 of the file 206 and/or a conventional part of the recipient 
station 226 displays 232 the message. The message 206 then 
deletes itself, thereby deleting the displayed copy of the 
message and preventing the code that did the display from 
redisplaying the message later. The deletion 234 may 
include an electronic shredding form of deletion, which 
overwrites the file (possibly several times) rather than 
merely marking it as free. 

In one embodiment, the displaying portion 214 of the 
executable code and the deleting portion 208 of the execut- 
able code are executed as one atomic operation, with the 
atomicity enforced by the operating system and/or by the 
particular processor on which the message file 206 executes. 
Tools and techniques for enforcing atomicity are well 
known, in the database arts and elsewhere. 

In one embodiment, the message file 206 incrementally 
overwrites itself while incrementally displaying 232 its 
message, with the overwriting and displaying increments 
interleaved in their operation. After decrypting 230 the 
message to form a block of message content 212 bytes in 
RAM, execution of displaying code 214 and removing code 
208 is interleaved as follows. The embodiment exchanges 
the video display bytes (which are something other than the 
message content 212) with the message content bytes (which 
are placed in a format used by the video display buffer). 
Several bytes at a time may also be thus exchanged. Each 
exchange displays another increment of the message and 
also overwrites part of the message content 212 with what- 
ever was previously being displayed. 

In one embodiment, the message file 206 loads itself into 
memory, deletes itself from disk in partial or complete 
performance of an active removal step 234, verifies the 
deletion, and only then performs the display operation 232. 
Concurrently with or shortly after the display, the message 
file may additionally overwrite itself in memory to complete 
step 234. 

Tools and techniques familiar to those of skill in the art for 
self-modifying code and/or self-deleting programs such as 
self-deleting scripts or self-deleting installers may be helpful 
during implementation of particular embodiments of the 
invention. Likewise, techniques used in Trojan horses, 
worms, viruses, and other programs which hide and/or 
propagate themselves may be modified for use in inventive 
email message files 206 which destroy themselves after 
displaying the message they carry. For instance, tools and 
techniques such as those employed in U.S. Pat. No. 5,623, 
600 may be adapted for use in the present invention. 

In some embodiments, the message file 206 installs the 
message content 212 (or the entire message file 206 itself) in 
locations on the hard disk and/or in memory which are 
subject to frequent overwriting once deallocated. Suitable 
locations include unused clusters temporarily marked as 
allocated in file allocation tables, or swap files, or portions 
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of RAM that are overwritten or scrambled during a reboot. 
After displaying its embedded message, the embodiment 
then marks itself (or at least the portion containing the 
message) as deallocated and forces overwriting during step 

5 234. For instance, the embodiment may force a reboot to 
scramble or overwrite RAM containing the message or mark 
temporarily allocated clusters free once more. 

The message content 212 may be encrypted so it cannot 
be read by simply viewing the message file 206 in a 

10 debugger and looking for strings. During authentication 228, 
the message file 206 may also require a password or key 
from the recipient 202 before decrypting 230 and displaying 
232 the message. 

Alternatively, the message file 206 may be self-decrypting 

15 (similar in spirit to self-extracting ZIP files) once it has 
verified its current location 226 as the one corresponding to 
the intended recipient 202. Thus, copies on ISP servers or 
other intermediate network nodes remain encrypted, but the 
copy of the message file 206 at the recipient's network 

20 address will decrypt 230 when launched. 

Network addresses, environmental parameters such as the 
surrounding processor and operating system, previously sent 
ID files, digital certificates, tokens (software or hardware), 
and other means can be used by the message file 206 to 

25 determine its present location. For instance, this can be done 
by checking the current IP or other network address against 
an address specified (directly or in terms of an email 
address) by the sender 200. If the email connection is 
available, a packet can also be sent to a specified location 

30 and the address on the response packet can be examined. Of 
course, the recipient's environment is not always fully 
known, and it can be imitated. But imposing "proper loca- 
tion" as a requirement for message content 212 display 232 
makes it harder to gain unauthorized access to those contents 

35 212. 

In some embodiments, means are used to make the use of 
a debugger generally, and the use of break points or trace 
points in particular, result in self-destruction of the message 
file 206 without display of the message contents 212, or at 

40 least in a failure to decrypt and display the message content 
212. Suitable means 216 include (a) timed loops with 
conditionals that change behavior based on the time required 
to execute the loop (debugging is delected as unusually slow 
execution); (b) checksums on the current code 208 in 

45 memory (insertion of breakpoints alters the checksum); and 
(c) the interrupt vector table is temporarily modified to 
ignore keyboard and mouse input and hence disable debug- 
ger commands (the message content 212 is displayed a 
preset period of time and then disappears forever). 

50 In some embodiments, steps are taken by the security 
code 216 to disable the Print Screen or similar command. 
For instance, a search for recognized print screen routines 
can be made and they can be temporarily disabled. Likewise, 
the interrupt vector table can be temporarily modified to 

55 limit input and hence disable print screen commands. 

In some embodiments, the message file 206 checks as 
much of the local environment as possible for other copies 
of itself and permanently deletes 234 them before displaying 
232 the message content 212. Some embodiments only 

60 search for the message's file name in other directories, while 
other embodiments search for files of the same length or 
recently created files and then examine those files more 
closely, in case the copy has been renamed. Techniques used 
to identify viruses can also be modified to help the message 

65 file 206 identify copies of itself. 

In some embodiments, techniques used in so-called "copy 
protection schemes" are ased by the security code 216 to 
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help prevent copying of the nnessage file 206. The tech- 
niques are niodified to allow copying by network system 
software as necessary for the message file 206 to travel 
across the network 100 from the originator 200 to the 
authorized recipient(s) 202. 5 

One embodiment does not initially delete itself after 
displaying the message contents 212. Instead, the message 
file 206 removal code 208 self-modifies to become a 
searcher. The searcher has a limited life span, measured 
either by elapsed time since its inception or by the number lO 
of times the searcher or its direct ancestors have been 
launched for execution. 

Thus, the first lime the message file 206 is run, it displays 
232 the message content 212, overwrites the message con- 
tent 212, and notes internally that it has done so. The next is 
N-1 times it is launched, it mns as a searcher. The searcher 
displays a dummy message such as "Decrypting message; 
please wait ..." to gain time while actually searching for 
other copies and permanently deleting 234 them. After 
finishing the search (and performing any appropriate 20 
deletions), the searcher displays a message such as "Decryp- 
tion failed. Please contact X for assistance," X might be the 
message originator 200, the message recipient 202, or both, 
and/or their corresponding system administrators. The Nth 
lime the searcher is run, the message file (searcher) perma- 25 
nently deletes 234 itself. In a variation, the searcher 206 
spawns additional searchers that behave in a similar manner. 

In one embodiment, a timestamp representing a limited 
life span is embedded in the message file 206, and if the 
current time (as indicated by a call made on the recipient's 30 
system) indicates that the intended life span has elapsed, 
then the message file simply deletes itself without displaying 
the message contents. Tools and techniques such as those 
employed in U.S. Pat. No. 5,786,817 may be adapted for use 
in the present invention. 35 
Signals 

Although particular methods and systems embodying the 
present invention are expressly illustrated and described 
herein, it will be appreciated that apparatus, signal, and 
article embodiments may be formed according to methods 40 
and systems of the present invention. Unless otherwise 
expressly indicated, the description herein of methods of the 
present invention therefore extends to corresponding 
apparatus, signal, and articles, and the description of 
apparatus, signals, and/or articles of the present invention 45 
extends likewise to corresponding methods. 

For instance, the message 206 may embody novel signals 
such as the self-removal indicators 210, and/or the various 
codes such as removal code 208 for performing the remov- 
ing step 234, display code 214 for performing the displaying 50 
step 232, and security code 216 for performing the authen- 
ticating step 228 or other security-enhancing steps such as 
disabling print screen or debugger functions. The signals 
may be embodied in "wires" 118, RAM, disk, or other 
storage media or data carriers. 55 

Articles of manufacture within the scope of the present 
invention include a computer- read able storage medium in 
combination with the specific physical configuration of a 
substrate of the computer- readable storage medium. The 
substrate configuration represents data and instructions 60 
which cause the computers to operate in a specific and 
predefined manner as described herein. Suitable storage 
devices include floppy disks, hard disks, tape, CD-ROMs, 
RAM, flash memory, and other media readable by one or 
more of the computers. Each such medium tangibly embod- 65 
ies a program, functions, and/or instructions that are execut- 
able by the machines to perform self -removing message 



creation, transmission, removal, display or other method 
steps substantially as described herein, including without 
limitation methods which perform some or all of the steps 
illustrated in FIG. 2. To the extent permitted by applicable 
law, programs which perform such methods are also within 
the scope of the invention. 
Summary 

In summary, the present invention provides a novel way 
to protect confidential and proprietary email message con- 
tents without substantially reducing the ease and conve- 
nience of email transmission. In fact, the ease of use for 
email recipients is increased, because they no longer need to 
imprecisely filter or manually remove unsoHcited notices or 
advertisements. Message originators also have more control 
over the persistence of their messages after the messages are 
sent, even if messages have been opened. ISPs and other 
distributors can verify and/or insert self-removal instruc- 
tions to make sure that directed mailings to their members 
comply with automatic removal requirements. 

Increased security is achieved, for instance, when email 
messages are embedded in executable files, each of which 
displays its particular message once and then permanently 
deletes itself and any copies of itself it can find. The message 
files may be embodied in computer storage media or (while 
in transit) in network connections. 

One embodiment employing message files at least for 
increased security according to the invention includes the 
following: 

uninstaller tools and techniques as a means for locating 
copies of the message file; 

copy protection tools and techniques as a means for 
preventing creation of copies of the message file except 
as needed by the message file originator *s email send- 
ing software, by the network transmission software, 
and by the intended recipient's email receiving soft- 
ware; 

encryption tools and techniques as a means for encrypting 
the message contents in the message file and decrypting 
the message contents as part of an atomic display- and - 
self-destruct step; 

virus detection tools and techniques, and uninstaller soft- 
ware tools and techniques, each as a means for locating 
unauthorized or no longer needed (e.g., copies made 
along the network transmission path after the received 
message has been displayed) copies of the message file 
(or of an extracted message) to be permanently deleted; 

electronic file shredder tools and techniques as a means 
for permanently deleting (erasing, removing, 
destroying) unauthorized or no longer needed copies of 
the message file; 

self-modifying code tools and techniques as a means for 
deleting the message file as the message is being 
displayed and/or for modifying the message file to 
spawn and manage searcher computer processes which 
seek out and permanently delete unauthorized or no 
longer needed copies of the message file; 

anti-reverse engineering and obfuscation tools and 
techniques, and digital signature or checksum tools and 
techniques, and interrupt manipulation tools and 
techniques, each as a means for protecting the integrity 
and security of the message file contents prior to 
authorized display of the message, each possibly in 
conjunction with encryption tools and techniques; and 

email and networking tools and techniques as a means for 
authorized copying and transmission of the intact mes- 
sage file from the originator to the intended and autho- 
rized recipient. 
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A particular order and grouping may be indicated in 
examples for method steps of the invention. However, those 
of skill will appreciate that the steps illustrated and dis- 
cussed in this document may be performed in various orders, 
including concurrently, except in those cases in which the 
results of one step are required as input to another step. For 
instance, deletion from disk during step 234 may precede 
display of the message during step 232, and may be filed by 
or interleaved with deletion of message contents 212 from 
RAM. Likewise, steps may be omitted unless called for in 
the claims, regardless of whether they are expressly 
described as optional in this Detailed Description. For 
instance, encryption steps, an ti -debugger steps, and screen 
print disabling steps are all optional actions by the security 
code 216, which is itself an option component in the 
message 206. Steps may also be repeated (e.g., transmittal 
between nodes during step 218), or combined (e.g., atomic 
display and removal steps 232 plus 234), or named differ- 
ently. 

Tlie invention may be embodied in other specific forms 
without departing from its essential characteristics. The 
described embodiments are to be considered in all respects 
only as illustrative and not restrictive. Headings are for 
convenience only, and are not limiting. Trademarks used 
herein are the property of their respective owners. Any 
explanations provided herein of the scientific, legal, or other 
principles employed in the present invention are illustrative 
only. The scope of the invention is, therefore, indicated by 
the appended claims rather than by the foregoing descrip- 
tion. All changes which come within the meaning and range 
of equivalency of the claims are to be embraced within their 
scope. 

What is claimed and desired to be secured by patent is: 

1. A method for use by a distributor to verify that 
self- removing messages are being used to shift the burden of 
message removal from a message recipient, the method 
comprising the steps by or for the distributor of: 

receiving at an intermediate node a message, from an 

originator other than the distributor, which is intended 

for a recipient; 
determining that the message meets at least one check 

triggering criterion and should therefore contain a 

self-removing message indicator; and 
checking the message to determine whether the message 

contains a self-removing message indicator. 

2. The method of claim 1, wherein the checking step 
determines that the message does not contain a self- 
removing message indicator, and the method further com- 
prises inserting a self-removing message indicator in the 
message and then transmitting the message from the inter- 
mediate node toward the recipient. 

3. llie method of claim 1, wherein the checking step 
determines that the message does not contain a self- 
removing message indicator, and the method further com- 
prises preventing transmittal of the message to the recipient. 

4. The method of claim 1, wherein the checking step 
determines that the message contains a self- re moving mes- 
sage indicator, and the method further comprises transmit- 
ting the message from the intermediate node toward the 
recipient. 

5. The method of claim 4, wherein the method further 
comprises stripping out the self-removing message indicator 
before transmitting the message to the recipient. 
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6. The method of claim 1, embodied in software which 
configures a computer storage medium. 

7. A method for removing email messages from a recipi- 
ent's location in response to an instruction from an ISP 

5 which is not the originator of the email messages, the 
method comprising the steps of: 
checking an email message at the recipient's location to 
determine whether it contains a self- re moving message 
indicator inserted by the ISP at an intermediate node 
indicating that the message is to be deleted automati- 
cally; and 

automatically removing the email message in response to 
the indicator if the message contains the indicator. 

8. The method of claim 7, embodied in software which 
configures a computer storage medium. 

9. The method of claim 7, wherein the removing step 
deletes the message regardless of whether it has been opened 
by the recipient. 

10. The method of claim 7, wherein the removing step 
deletes the message on a date specified by the indicator. 

2° 11. The method of claim 7, wherein the removing step 
deletes the message after it is received and within a period 
of time specified by the indicator. 

12. The method of claim 7, wherein the removing step 
deletes a notice by removing the message. 

13. The method of claim 7, wherein the removing step 
deletes a news item by removing the message. 

14. The method of claim 7, wherein the removing step 
deletes an advertisement by removing the message. 

15. The method of claim 7, wherein the removing step 
deletes a link to a web site by removing the message. 

16. A computer network intermediate node, comprising: 
tools for sending and receiving messages through the 

network, and 

code configuring the intermediate node for allowing a 
message distributor to identify at the intermediate node 
messages that should contain a self -removal enhance- 
ment for automatic removal of a copy of the message's 
content, 

wherein the intermediate node helps shift the burden of 
removing a message from a message recipient or mes- 
sage originator to the message distributor who is not the 
message originator. 

17. The intermediate node of claim 16, further comprising 
code allowing the message distributor to insert a self- 
removing message indicator in a message. 

18. The intermediate node of claim 17, wherein the 
self-removing message indicator indicates the message will 
be automatically deleted in response to a specified storage 
space condition. 

19. The intermediate node of claim 17, wherein the 
self-removing message indicator indicates the message will 
be automatically deleted in response to a replacement mes- 
sage. 

20. The intermediate node of claim 16, wherein the code 
allows the message distributor to identify messages that 
should contain a self-removal enhancement by determining 
whether the message is part of an authorized mailing. 

21. The intermediate node of claim 16, wherein the code 
allows an ISP acting as message distributor to identify email 
messages that should contain a self-removal of a copy of the 
message's content, 

* « « * * 
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